Graduate Students Unlock Code of 'Thiefproof' Car Key

In article .com>, wrote:
> of course it's against the law, but people will still do it!

What's against the law is the DMCA.

"Mark Lomas" > wrote in message
.. .
>
> "MrPepper11" > wrote in message
> oups.com...
> ...
>> Mr. Sabetti of Texas Instruments argues that grabbing the code from a
>> key would be very difficult, because the chips have a very short
>> broadcast range. The greatest distance that his company's engineers
>> have managed in the laboratory is 12 inches, and then only with large
>> antennas that require a power source.
>
> About ten years ago I wrote a patent application for a car lock which was
> designed to
> protect against dishonest valet-parking staff. Mr Sabetti appears not to
> consider this
> part of his threat model.
>
> As I had not previously written a patent application, mine followed an
> unconventional
> structure (for a patent): I described a system, showed how to attack it,
> then how to
> improve it to guard against the attack; I repeated this until I arrived at
> a design that I
> was satisfied with.
>
> My patent agent telephoned to tell me that one of my strawmen (i.e. a
> design that
> I had explicitly rejected) had turned up in his patent search, under the
> name 'Tiris',
> owned by Texas Instruments.
>
> I'm curious as to how TI's current system differs from the Tiris system?
>
> Are there any commercially-available car locks designed to defend against
> somebody
> with unsupervised access to the key?
>
> Mark

Tiris was spun off or sold away from TI and is now Sirit (how original) and
they are located in Carrollton, Texas. Of the systems I'm aware of, Tiris
built the toll collection system for the state of California as well as many
gated community RFID readers.

-Bruce

"Bob Harris" > wrote in message
news:BE2435D4.48048%plasticnitlion@wrappermindspri ng.com...
> y_p_w wrote:
> > Bob Harris wrote:
> >> MrPepper11 wrote:
> >>>> Graduate Cryptographers Unlock Code of 'Thiefproof' Car Key
> >>>> By JOHN SCHWARTZ
> >>
> >> and Mr Nobody replied:
> >>> I thought it was against the (US) law to try to crack codes like this,
> >>> or does that only apply to copy-protection on DVDs and the like?
> >>
> >> Maybe the difference is that there's no "intellectual" property being
> >> protected by the car key. Only a car which can't be duplicated. The
> >> government suffers no loss when a car is stolen. If 1,000 copies of a
DVD
> >> are made, the government loses tax revenue.
> >
> > These guys tried it out on vehicles they owned or had permission
> > to use.
>
> But the same thing, done to a DVD which I own, is (apparently) illegal.
It
> is (apparently) illegal to figure out how to break the security on a $25
DVD
> but not on a $40,000 car.
>

Your mistaken. Research in breaking crypto systems isn't illegal. What is
illegal
is providing the results of that research to the public. And even then this
is very
debatable because it's in direct conflict with the 1st amendment.

There is a book out there titled "Cracking DES'" which gives complete
unabridged
instructions and software - published on paper, you have to scan or type it
into
a computer - for cracking the DES algorithm. It was published deliberately
to
provoke a lawsuit I think. The government refrained from citing the authors
or
publisher becase, of course, if they had done so it would have gone straight
to the Supreme Court.

What the DMCA attempts to do is redefine software from published material -
elegible for protection under the Freedom of Speech guarentees - to a
'device'.
Devices are not speech and thus can be regulated by the government. So far
the government is interpeting it this way and the US Supreme Court has not
yet weighed in on whether source code published electronically is protected
speech or whether it is a device.

Your DVD contains the CSS encryption system which has been broken a
while ago. There are companies which publish - on paper, and even on
Tee Shirts, - the decrypting algorithm - DeCSS - and sell these perfectly
legitimately in the United States.

Unfortunately the biggest problem so far is that the way that the law works
in
the United States is that a person cannot appeal for relief from the court
system
until after they have been arrested and charged with violating the DMCA -
and
so far the only people getting arrested for breaking security algorithms are
people who are either using the results of such work to steal software,
movies,
or music, or people who are providing working programs or finished source
code
that a child can compile and use, that are really only good for pirating
software,
movies, music, or other copyrighted materials.

These kinds of cases do not make for good US Supreme Court test cases to
get unconstitutional laws overturned, and cases that would make good test
cases - like the Dimitry Sklyarov one - are quickly hustled out of the court
system with charges dropped shortly afterwards by the cooler and wiser
heads.

Unfortunately these "illegal security breaking laws" are basically turning
into
laws like the one in my hometown of Portland OR which makes it a crime to
wear roller skates into a public restroom. In short, they are laws on the
books
that are never invoked against people who aren't already doing something
that
is seriously questionable, and are valuable mostly to government bureaucrats
to wave around and threaten people who don't know any better. And the
people that are actually found guilty of violating them are generally in
such
deep do-do with violating a bunch of other laws that they have bigger things
to worry about, as it were.

In this instance the students could easily publish - on paper - thesis and
such
based on this work that contain complete descriptions and plans for building
a key-security-breaker, and have full 1st amendment protection. However
this
would probably make it impossible to get their thesis published in any U.S.
academic journals because such journals nowadays publish a signficant amount
electronically, and less and less on actual physical paper. Thus, the
federal
bureaucrats end up getting their way, as you can see.

Ted

"Xcott Craver" > wrote in message
...
> Bill Unruh > wrote:
> >
> >The DMCA specifically exempts research.
> >(Read the act to get the caveates)
>
> Not really. It exempts the act of circumvention for "encryption
> research", but still outlaws the buying/selling/making of the tools
> to do so. It also has to be _encryption_ research, so if you break
> a security system that does not overtly use encryption, the exemption
> doesn't necessarily cover you.
>
> IMHO the research exemption was carefully written to be unusable.
> If it actually protects you, it will be because a judge decided to
> interpret it very broadly, contradicting the intent of the authors.
>
> What would protect these researchers is that the DMCA only applies
> to technologies that protect a copyrighted work.

You need to be careful what you say here. The DMCA doesen't deal with
technologies. It deals with devices. You can publish - on paper - any
technology you want and be protected under the freedom of the press
guarentees
in the constitution. However a software program that breaks encryption
that is published on paper isn't going to be usable by most of the 14 year
olds
who are pirating each other's DVDs, so it is unlikely that any of the DMCA
proponents are going to give a **** about it.

Ted

In article >, Ted Mittelstaedt wrote:

> Unfortunately these "illegal security breaking laws" are basically turning into
> laws like the one in my hometown of Portland OR which makes it a crime to
> wear roller skates into a public restroom. In short, they are laws on the books
> that are never invoked against people who aren't already doing something that
> is seriously questionable, and are valuable mostly to government bureaucrats
> to wave around and threaten people who don't know any better. And the
> people that are actually found guilty of violating them are generally in
> such deep do-do with violating a bunch of other laws that they have
> bigger things to worry about, as it were.

I don't see it quite that way, but it often does work the way you
describe. I see US law as one of being ticky-tacky laws everywhere with
selective and/or random enforcement. If you're not liked you can expect
laws to be enforced on you that won't be enforced on others. Same if you
are poor, etc and so on. Basically making it such that nobody can get
through the day without violating some sort of law. If a citizen becomes
a problem for some elected offical he can expect many of these laws to
suddenly be enforced in his case.